{"id":"CVE-2026-113800","kind":"vulnerability","aliases":["CVE-2026-113800","GHSA-fw47-9c62-h3vw"],"related":[],"title":"Electron: HID and USB permission checks can be attributed to the wrong origin","description":"### Impact\nFor `hid` and `usb` permission checks made from an iframe, `session.setPermissionCheckHandler` was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.\n\nYou're only affected if you use `setPermissionCheckHandler` with origin-based logic for `hid` or `usb` and embed cross-origin iframes with `allow=\"hid\"` or `allow=\"usb\"`. Apps that don't delegate those features to untrusted iframes are not affected.\n\n### Workarounds\nDon't add `allow=\"hid\"` / `allow=\"usb\"` to untrusted iframes, or make the decision in your `select-hid-device` / `select-usb-device` handler using `details.frame`.\n\n### Fixed Versions\n* `45.0.0-alpha.5`\n* `44.3.0`\n* `43.7.0`\n* `42.11.3`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"Electron's session.setPermissionCheckHandler reported the top-level page's origin and details for hid and usb permission checks made from iframes, instead of the iframe's own. An embedded cross-origin frame that was delegated hid or usb can therefore be granted access meant for the top-level page by origin-based logic.","severity":"medium","cvss":5.400000095367432,"epss":0.002409999957308173,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["45.0.0-alpha.5"],"affected":">= 45.0.0-alpha.1, < 45.0.0-alpha.5","ecosystem":"npm"},{"name":"electron","fixed":["44.3.0"],"affected":">= 44.0.0-alpha.1, < 44.3.0","ecosystem":"npm"},{"name":"electron","fixed":["43.7.0"],"affected":">= 43.0.0-alpha.1, < 43.7.0","ecosystem":"npm"},{"name":"electron","fixed":["42.11.3"],"affected":"< 42.11.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-346","desktop-apps","electron","hid","runtime","usb"],"not_affected_if":["default-config","no-cross-origin-iframes-with-hid-usb","no-hid-usb-permission-handler"],"how_to_check":"Search app code for setPermissionCheckHandler and check whether it allows 'hid' or 'usb' based on origin.\nCheck for iframes with allow=\"hid\" or allow=\"usb\" pointing to cross-origin or untrusted content.\nCheck the installed electron version in package.json and node_modules/electron/package.json.","fix":"Upgrade to electron 45.0.0-alpha.5, 44.3.0, 43.7.0, or 42.11.3, matching your release line.\nUntil upgraded, stop delegating hid/usb to untrusted iframes or decide using details.frame in the select-hid-device / select-usb-device handler.","status":"open","published_at":"2026-10-21T17:18:25+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T19:58:14+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T19:58:14Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to electron 45.0.0-alpha.5, 44.3.0, 43.7.0, or 42.11.3, matching your release line.\nUntil upgraded, stop delegating hid/usb to untrusted iframes or decide using details.frame in the select-hid-device / select-usb-device handler.","summary":"Electron's session.setPermissionCheckHandler reported the top-level page's origin and details for hid and usb permission checks made from iframes, instead of the iframe's own. An embedded cross-origin frame that was delegated hid or usb can therefore be granted access meant for the top-level page by origin-based logic.","category":"runtime","who_cares":["electron","desktop-apps","hid","usb"],"confidence":0.85,"analyst_note":"","how_to_check":"Search app code for setPermissionCheckHandler and check whether it allows 'hid' or 'usb' based on origin.\nCheck for iframes with allow=\"hid\" or allow=\"usb\" pointing to cross-origin or untrusted content.\nCheck the installed electron version in package.json and node_modules/electron/package.json.","needs_analyst":false,"not_affected_if":["no-hid-usb-permission-handler","no-cross-origin-iframes-with-hid-usb","default-config"],"severity_if_unknown":"medium"},"cost_usd":0.000474,"input_tokens":2456,"output_tokens":456,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113800':16A,24A '-2026':15A,23A '-346':30B '42.11.3':221C '43.7.0':220C '44.3.0':219C '45.0.0':217C '9c62':20A 'access':82B,137C 'add':190C 'advisori':234C 'affect':148C,186C 'allow':126C,169C,172C,191C,193C 'alpha.5':218C 'app':33B,124C,174C 'attribut':9A 'base':93B,129C,156C 'check':6A,56B,101C 'comment':231C 'could':132C 'cross':69B,165C 'cross-origin':68B,164C 'cve':14A,22A 'cwe':29B 'decis':201C 'deleg':74B,178C 'desktop':32B 'desktop-app':31B 'detail':50B,117C 'details.frame':214C 'devic':207C,211C 'electron':1A,25A,26A,27A,28A,34B,38B 'email':235C 'emb':163C 'embed':67B,135C 'featur':180C 'fix':215C 'frame':71B,113C,122C,136C 'fw47':19A 'ghsa':18A 'ghsa-fw47-9c62-h3vw':17A 'given':108C 'grant':81B,133C 'h3vw':21A 'handler':212C 'hid':2A,35B,52B,75B,97C,159C,170C,192C,206C 'ifram':59B,63B,105C,167C,183C,197C 'impact':95C 'inform':224C 'instead':60B,118C 'intend':138C 'level':45B,88B,112C,143C 'logic':94B,157C 'made':57B,102C 'mailto':239C 'make':199C 'meant':83B 'origin':13A,48B,70B,92B,115C,131C,155C,166C 'origin-bas':91B,154C 'page':46B,89B,144C 'permiss':5A,55B,100C,128C 'question':229C 're':146C 'report':41B 'request':121C 'runtim':36B 'security@electronjs.org':238C,240C 'select':205C,209C 'select-hid-devic':204C 'select-usb-devic':208C 'session.setpermissioncheckhandler':40B,106C 'setpermissioncheckhandl':152C 'therefor':79B 'top':44B,87B,111C,142C 'top-level':43B,86B,110C,141C 'untrust':182C,196C 'us':236C 'usb':4A,37B,54B,77B,99C,161C,173C,194C,210C 'use':151C,213C 'version':216C 'workaround':187C 'wrong':12A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-fw47-9c62-h3vw","url":"https://github.com/advisories/GHSA-fw47-9c62-h3vw","severity":"medium","published_at":"2026-10-21T17:21:51+00:00","modified_at":"2026-10-21T17:21:53+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-113800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113800","severity":null,"published_at":"2026-10-21T17:18:25+00:00","modified_at":"2026-10-23T15:17:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}